Approved changes feed: RSS · Atom
cpe:2.3:a:coding-solo:godot_mcp:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Coding Solo (08542d24-6f14-5684-9fbd-02a60864a2df) |
|---|---|
| Product | Godot Mcp (2105714f-cc77-521c-bf3c-064a5e3d881a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/coding-solo/godot-mcp |
purl2cpe | 2026-07-28 16:41:08.491054 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-25546 |
vulnerable | 2026-06-08 07:53:19.982346 |
Godot MCP is vulnerable to Command Injection via unsanitized projectPath
HIGH (7.8)
Godot MCP is a Model Context Protocol (MCP) server for interacting with the Godot game engine. Prior to version 0.1.1, a command injection vulnerability in godot-mcp allows remote code execution. The executeOperation function passed user-controlled input (e.g., projectPath) directly to exec(), which spawns a shell. An attacker could inject shell metacharacters like $(command) or &calc to execute arbitrary commands with the privileges of the MCP server process. This affects any tool that accepts projectPath, including create_scene, add_node, load_sprite, and others. This issue has been patched in version 0.1.1.
Published: 2026-02-04T21:48:53.225Z
Updated: 2026-02-05T17:51:29.147Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.